Brute Force Decryption Vulnerability in Fortra's GoAnywhere MFT

CVE-2025-1241

What is CVE-2025-1241?

A vulnerability exists in Fortra's GoAnywhere MFT and GoAnywhere Agents that stems from the use of a static Initialization Vector (IV) for encrypting sensitive data. This flawed implementation enables an adversary, with sufficient privileges, to execute brute-force attacks to decrypt the data, potentially exposing sensitive information. It is critical for users of affected versions to upgrade to the latest releases to safeguard their data against this exploitation.

References